CVE-2025-12543: Red Hat Build Of Apache Camel

Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days.

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Affected products

• Red Hat Build Of Apache Camel: before 4.14.4 (fixed in 4.14.4)
• Red Hat Data Grid: version 8.0 only
• Red Hat Fuse: version 7.0.0 only
• Red Hat JBoss Enterprise Application Platform: from 8.0, before 8.0.12 (fixed in 8.0.12); from 8.1.0, before 8.1.3 (fixed in 8.1.3); affected versions not specified; version 7.0.0 only
• Red Hat JBoss Enterprise Application Platform Expansion Pack: affected versions not specified
• Red Hat Process Automation: version 7.0 only
• Red Hat Single Sign-On: version 7.0 only
• Red Hat Undertow: before 2.2.39 (fixed in 2.2.39); from 2.3.0, before 2.3.21 (fixed in 2.3.21)

Published 2026-01-07. Last modified 2026-10-06.